ClawHub
Back to skill

Security audit

gembox-skill

Security checks across malware telemetry and agentic risk

Overview

This is a GemBox coding-help skill that points agents to local NuGet docs and official GemBox documentation, with no evidence of hidden execution or data access.

Install this if you want GemBox-specific coding assistance. Expect it to inspect local NuGet documentation, search official GemBox documentation, and compile your project for validation; review any generated code carefully before running it, especially code that sends email, connects to mailboxes, or handles private documents.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill’s activation scope is extremely broad: it triggers on essentially any coding task involving any GemBox component, spanning documents, spreadsheets, PDFs, presentations, imaging, and email. Over-broad routing increases the chance the agent invokes this skill in situations involving file access, networked email operations, or sensitive data handling without an explicit user intent boundary or safety gating.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The description advertises send/receive email capabilities but provides no warning that the skill may access external networks, interact with mailboxes, or process potentially sensitive mailbox contents. In an agent setting, omission of these boundaries can lead to unsafe use in contexts involving credentials, message exfiltration, or unintended external communications.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.